Unauthorized access to labels of private organizations in Gitea (CVE-2026-25038)

Gitea 1.26.2 does not properly enforce organization visibility restrictions on the organization label read endpoints. An unauthorized user - one without membership in a private organization - can retrieve that organization's label metadata via the `GET /api/v1/orgs/{org}/labels` and `GET /api/v1/orgs/{org}/labels/{id}` API endpoints, despite receiving a 404 response for the organization itself. The impact is limited to unauthorized read access to label metadata; write operations remain protected. Affected versions: - 1.26.2 We recommend updating to: 1.26.3. CVSS 7.5 · our assessment: this_week Reference: https://github.com/go-gitea/gitea/security/advisories/GHSA-v73x-hx65-6pf4 Details: https://vuln.today/cve/CVE-2026-25038